Supply CORS in server HTTP API #64

New issue

Closed

opened 2026-04-01 23:41:51 +00:00 by luca0N · 2 comments

luca0N commented

2026-04-01 23:41:51 +00:00

Owner

Although the server API was implemented in pull request #62, the server does not respond to OPTIONS requests, which will cause issues for most user agents under certain conditions due to CORS. Without CORS, the API is useless, as web browsers may refuse to connect to the server.

As such, CORS rules should be supplied for each individual API endpoint in the server.

Although the server API was implemented in pull request #62, the server does not respond to `OPTIONS` requests, which will cause issues for most user agents under certain conditions due to CORS. Without CORS, the API is useless, as web browsers may refuse to connect to the server. As such, CORS rules should be supplied for _each individual API endpoint_ in the server.

luca0N added the

Kind/Security

Priority

High

labels

2026-04-01 23:41:51 +00:00

luca0N self-assigned this

2026-04-01 23:41:51 +00:00

luca0N added this to the v1.0.0 project

2026-04-01 23:41:54 +00:00

luca0N commented

2026-04-02 23:05:30 +00:00

Author

Owner

Access-Control-Allow-Origin should be set to * by default. Some administrators may wish to restrict this header for hardening purposes, so there should be a server configuration option to control this.

[`Access-Control-Allow-Origin`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Allow-Origin) should be set to `*` by default. Some administrators may wish to restrict this header for hardening purposes, so there should be a server configuration option to control this.

luca0N commented

2026-04-02 23:59:18 +00:00

Author

Owner

Fixed by 1936060.

Fixed by 1936060.

luca0N closed this issue

2026-04-02 23:59:19 +00:00